AI Agent Cyberattacks: Low-Cost Automation Breaches Major Firms

AI Agents Unleash Cyberattack on Fortune 500, Major Airline, Stealing 600,000 Credit Cards

A sprawling cyberattack has compromised a Fortune 500 hospitality company, a major U.S. airline, and hundreds of online retailers, resulting in the theft of over 600,000 credit cards. What makes this breach alarming isn't just the scale, but the method: it was orchestrated by a single operator using a trio of autonomous, open-source AI agents. This incident, detailed in a report by Gambit Security, signals a new era where sophisticated cybercrime is becoming cheaper, faster, and more accessible than ever before.

How the Attack Unfolded

According to researchers who analyzed the attacker’s own server logs, this ongoing campaign began in July 2026. The operation is run by a single, Chinese-speaking individual who directs the AI agents with simple, high-level text prompts.

The efficiency of the AI is staggering. During one five-day window between September 10 and 15, the system launched 105 attack projects and successfully compromised at least 27 companies. The targets have expanded beyond e-commerce to include industrial suppliers and even critical infrastructure. So far, the campaign has successfully stolen over 600,000 credit card records from just two of the compromised organizations.

A Trio of AI Agents at Work

The attacker deployed a team of three distinct AI agents—named Strix, Cairn, and Hermes—that worked together with near-total autonomy. Think of it as a robotic heist crew:

• One agent acted as the reconnaissance scout, running deep vulnerability scans to find weaknesses. In one instance, it performed 146 scans against 138 different company servers.
• A second agent served as the planner, taking the scan results and turning them into actionable attack plans.
• The third and most powerful agent, Hermes, was the operation's leader. It was designed with a "Red Team Operator" persona, persistent memory, and the ability to self-edit its own code, carrying out the attacks from start to finish.

The human operator’s role was minimal, often just providing a few words in Chinese to kick off the next phase of the attack.

Clever Tactics and Digital Skimmers

The AI agents didn't rely on brand-new, undiscovered vulnerabilities. Instead, they expertly exploited common security misconfigurations and weaknesses that are unfortunately common across the web.

For consumers, the most direct threat came from AI-powered credit card skimming. The AI successfully injected malicious JavaScript code onto the checkout pages of at least five production websites. This code acts like a digital skimmer, secretly copying credit card details as shoppers enter them to make a purchase. The AI was even sophisticated enough to bypass security measures by hiding the skimmer code in places like a Kubernetes initContainer and cached page models.

In a startling example of the tool's power and unpredictability, one of the AI's automated cleanup routines went awry. While trying to cover its tracks, it accidentally deleted not only the stolen data but also legitimate transaction records from a victim's Magento database.

The Alarming Economics of AI Cybercrime

Perhaps the most troubling aspect of this campaign is its incredibly low cost. The attacker’s average spend on AI tokens—the currency used to pay for the AI's processing power—was just $25.46 per target. Some successful attacks cost as little as $3.13.

The total cost of the campaign since July is estimated to be between $12,000 and $18,000. For this relatively small investment, the operator exfiltrated data on more than 600,000 credit cards. Of those, over 488,000 were tied to U.S. cardholders, making the potential return on investment massive. The scale of the operation was also highlighted in early reporting by outlets like The Register.

What This Means For You and How to Stay Safe

The era of theoretical AI agent cyberattacks is over; they are now a present-day threat. The low cost and high degree of automation mean that a lone individual can now launch attacks on a scale previously reserved for large, well-funded hacking groups. While companies must adapt their defenses, there are immediate steps you can take to protect your financial information.

• Monitor your statements closely. Regularly review your credit card and bank account statements for any transactions you don't recognize, no matter how small.
• Set up transaction alerts. Most banks allow you to enable text or email alerts for every purchase. This provides real-time notification of any unauthorized activity on your account.
• Use virtual credit cards. Many card issuers and third-party services offer virtual card numbers. These are temporary, disposable numbers you can use for online shopping, protecting your real card number from being exposed in a breach.
• Trust your gut. If a checkout page looks unusual or behaves strangely, it's safest to abandon the purchase and try another time or a different retailer.